Top Risks

• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and third-party sharing.
• manifest_source is html_fallback: no CRX analysed, permissions and code surface are completely unverifiable for 2M-install extension.
• Developer email is a Google Groups address (pact-interactive@googlegroups.com) — no verifiable business identity.
• Description promises download capability but 'downloads' permission is absent per description_promise mismatch.
• Rating of 3.7 on a high-install extension may reflect quality or trust issues.

Evidence

• manifest_source=html_fallback store No CRX analysed; permissions, code quality, and manifest version are entirely unknown for a 2M-install extension.
• privacy_policy_generic api Policy URL is Google account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0 privacy (v3.5 rule D).
• developer_email_google_groups store pact-interactive@googlegroups.com is a mailing-list address, not a verifiable business domain; +1.5 reputation.
• description_promise_mismatch store Promises download but lacks 'downloads' permission per description_promise.mismatches; +2.0 webstore.
• high_install_count store 2,000,000 installs: +1.0 (>10K) +1.0 (>100K) +0.5 (>1M) = +2.5 webstore reach.
• is_featured_by_google store Featured badge present; applied -2.0 reputation discount.
• no_bad_hosts_no_cves api threat_intel bad_host_hits, affiliate_hits, monetization_hits all empty; cve_findings_raw empty.
• recently_updated store months_since_update=1; maintenance pillar = 0.0.

Pillar Scores

Scoring History

Bookkeeping